By default gnats does not treat incoming confidential PRs as
confidential; it requires manual filtering in the surrounding email
logic.

gnats has no support whatsoever for automatically handling bounced
mail.

There's no way to disable sending mail to email addresses that are
known to be invalid.

When a bug is closed, there's no way to disambiguate from its
closed state whether it's fixed, invalid, obsolete, or otherwise
"won't fix".

User interface

gnats has no ability to do anything by web besides display PRs, and
they display only as plain text. Things that you should be able to do
that you can't include:

filing comments

browsing from one PR to other related ones (either explicit links
from one PR to another, or retriving other PRs with similar
properties)

subscribing to PRs to get updates (even by email, let alone by RSS)

The only way to do administrative operations is to run an editor on
the backend text file representation of a single bug. This means you
can't readily:

massedit PRs (e.g. put a lot of related PRs in feedback at once)

update someone's email address

move misfiled comments from one PR to another

But you can't file a comment on a PR from the command line; you have
to send email.

The nag mails that gnats sends to submitters are annoying to handle;
in particular just replying to them does not go anywhere useful.

The nag mails that gnats sends to developers list a bunch of PRs but
do not list them in any kind of useful order; nor does gnats note
what's different since the previous one.

Querying and search

There's a web search form, but it's close to useless, partly because
it doesn't take input well and partly because the lists of results it
produces is unsorted, unstructured, and impossible to work with.

The command-line interface supports search... using a custom query
"language" that's nearly impossible to use and that furthermore has
most of the same drawbacks as the web search page. In order to do
anything much useful you need to write your own scripts that wrap the
output.

Finding stuff in the database is sufficiently hard that many people
consider it effectively impossible.